Hashes, HMACs, bcrypt, JWTs and one-time codes, worked out on your own machine
Everything here runs in your browser. Files are never uploaded.Every one of these tools handles something that should never be typed into a website: a token from a live session, a password hash, a signing key, a TOTP secret. That is exactly why they run in your browser and make no network request. Decode a JWT and check its signature, hash a file and compare the checksum, generate a bcrypt hash at a chosen cost, or watch authenticator codes tick over from a secret you hold.
Hash Generator produces MD5, SHA-1, SHA-256, SHA-384 and SHA-512 of text or a file and compares two checksums for you, which is what a downloaded installer's published hash is for. Use SHA-256 for anything that matters: MD5 and SHA-1 are still fine for spotting accidental corruption and are broken for anything an attacker can influence.
HMAC Generator computes and checks a keyed signature, the mechanism behind almost every webhook: the sender signs the body with a shared secret and you recompute it to prove the request is genuine. JWT Decoder opens a token, shows the header and claims, verifies the signature against a key, and will also sign a new one.
Bcrypt hashes a password at a cost from 4 to 14 and verifies a password against an existing hash. The cost is the point: each step up doubles the work, so a hash that takes your server a quarter of a second takes an attacker the same quarter of a second per guess. Cost 10 to 12 is the usual answer for a web application, and cost 4 exists for test fixtures.
Password Generator makes random passwords and memorable passphrases on your device. Password Strength Checker estimates how long a given password would survive and names what is weak about it, which is more useful than a coloured bar.
TOTP Generator turns a secret into the six digits an authenticator app would show, draws the QR code for enrolling one, and tests a code against a secret. It is for building and debugging two-factor login, not for storing your own accounts, because a secret pasted into a browser tab is a secret that has been somewhere else.
Certificate Decoder reads an X.509 certificate, a signing request or a public key and lists what a browser looks at: subject and issuer, both validity dates with whether it has expired right now, serial, signature algorithm, key size, every subject alternative name and the SHA-1 and SHA-256 fingerprints. Check a CSR before sending it to an authority, compare a fingerprint against the padlock in your browser, or work out why a certificate that looks correct is being rejected. A private key is recognised and deliberately left undecoded.
Nothing here makes a network request with your input. That is not a feature, it is the only way these tools can honestly exist: a site that offers to decode your JWT and sends it to a server has just been given a live session.
Safer than on most sites, because decoding and verification happen in your browser and nothing is sent anywhere. The safest habit is still to use an expired or test token when you can.
SHA-256 unless something requires otherwise. MD5 and SHA-1 are broken against a deliberate attacker and remain acceptable only for detecting accidental corruption, such as checking a download completed.
Between 10 and 12 for a web application in 2026, then measure: aim for roughly 250 milliseconds per hash on your production hardware. Every increment doubles the time, for you and for anyone guessing.
For development, yes. For your own accounts, no: it means keeping the secret somewhere you paste it into a browser. Use a real authenticator app on a phone for anything you care about.
Because most websites count character classes and this estimates guesses. Password1! satisfies almost every rule and is guessed in moments, while four random words break every rule and survive.
No. There is no account, no history and no logging of what you paste. Close the tab and it is gone.